The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3216-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to bypass same origin restrictions, obtain     sensitive information, spoof the addressbar, spoof the print dialog, cause a denial of service via     application crash or hang, or execute arbitrary code. (CVE-2017-5398, CVE-2017-5399, CVE-2017-5400,     CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405, CVE-2017-5406, CVE-2017-5407,     CVE-2017-5408, CVE-2017-5410, CVE-2017-5412, CVE-2017-5413, CVE-2017-5414, CVE-2017-5415, CVE-2017-5416,     CVE-2017-5417, CVE-2017-5418, CVE-2017-5419, CVE-2017-5420, CVE-2017-5421, CVE-2017-5422, CVE-2017-5426,     CVE-2017-5427)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-0461 advisory.

    [52.0-4.0.1]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [52.0-4]
    - Update to 52.0 ESR (b4)

    [52.0-3]
    - Added fix for rhbz#1423012 - ppc64 gfx crashes

    [52.0-2]
    - Enable system nss

    [52.0-1]
    - Update to 52.0ESR (B1)
    - Build RHEL7 package for Gtk3

    [52.0-0.13]
    - Added fix for rhbz#1414535

    [52.0-0.12]
    - Update to 52.0b8

    [52.0-0.11]
    - Readded addons patch

    [52.0-0.10]
    - Update to 52.0b3

    [52.0-0.9]
    - Update to 52.0b2

    [52.0-0.8]
    - Update to 52.0b1

    [52.0-0.5]
    - Firefox Aurora 52 testing build

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for firefox is now available for Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 45.8.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5404, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5405)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Nils, Jerri Rice, Rh0, Anton Eliasson, David Kohlbrenner, Ivan Fratric of Google Project Zero, Anonymous, Eric Lawrence of Chrome Security, Boris Zbarsky, Christian Holler, Honza Bambas, Jon Coppeard, Randell Jesup, Andre Bargull, Kan-Ru Chen, and Nathan Froyd as the original reporters.

This update to Mozilla Thunderbird 45.8.0 fixes security issues and bugs.

The following security issues from advisory MFSA 2017-07 were fixed.
(boo#1028391) In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts :

  - CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP

  - CVE-2017-5401: Memory Corruption when handling     ErrorResult

  - CVE-2017-5402: Use-after-free working with events in     FontFace objects (bmo#1334876)

  - CVE-2017-5404: Use-after-free working with ranges in     selections

  - CVE-2017-5407: Pixel and history stealing via     floating-point timing side channel with SVG filters

  - CVE-2017-5410: Memory corruption during JavaScript     garbage collection incremental sweeping

  - CVE-2017-5408: Cross-origin reading of video captions in     violation of CORS

  - CVE-2017-5405: FTP response codes can cause use of     uninitialized values for ports (bmo#1336699)

  - CVE-2017-5398: Memory safety bugs fixed in Thunderbird     45.8

The following non-security issues were fixed :

  - crash when viewing certain IMAP messages

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the processing of     malformed web content. A web page containing malicious     content could cause Firefox to crash or, potentially,     execute arbitrary code with the privileges of the user     running Firefox. (CVE-2017-5398, CVE-2017-5400,     CVE-2017-5401, CVE-2017-5402, CVE-2017-5404,     CVE-2017-5407, CVE-2017-5408, CVE-2017-5410,     CVE-2017-5405,CVE-2017-5428)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been found in the Mozilla Thunderbird mail client: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or spoofing.

With version 45.8 Debian drops it's custom branding from the Icedove package and ships the mail client as Thunderbird again. Please see the link below for further information:
https://wiki.debian.org/Thunderbird

Transition packages for the Icedove packages are provided which automatically upgrade to the new version. Since new binary packages need to be installed, make sure to allow that in your upgrade procedure (e.g. by using 'apt-get dist-upgrade' instead of 'apt-get upgrade').

For Debian 7 'Wheezy', these problems have been fixed in version 1:45.8.0-3~deb7u1.

We recommend that you upgrade your icedove packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
97600	Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3216-1)	Nessus	Ubuntu Local Security Checks	2017/3/8	2024/8/27	critical
97627	Oracle Linux 7 : firefox (ELSA-2017-0461)	Nessus	Oracle Linux Local Security Checks	2017/3/9	2024/10/22	critical
97628	RHEL 5 / 6 : firefox (RHSA-2017:0459)	Nessus	Red Hat Local Security Checks	2017/3/9	2025/12/30	critical
97748	openSUSE Security Update : MozillaThunderbird (openSUSE-2017-345)	Nessus	SuSE Local Security Checks	2017/3/15	2025/12/30	critical
99893	EulerOS 2.0 SP1 : firefox (EulerOS-SA-2017-1048)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	critical
99442	Debian DLA-896-1 : icedove/thunderbird security update	Nessus	Debian Local Security Checks	2017/4/19	2025/12/25	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical